## Problem `glab artifact-registry login` has writers for `--docker`, `--maven`, `--gradle`, `--npm` and `--sbt`, but none for Yarn. Yarn Berry does not read `~/.npmrc` for authentication, so `--npm` is not a substitute: it writes a file Yarn never consults. This is the one gap in the GitLab Artifact Registry setup instructions panel (gitlab-org/gitlab!255741). Every other tool in that panel now leads with a `glab artifact-registry login` command. Yarn instead links out to the authentication documentation, because there is no command to give it. ## Proposal Add `--yarn`, writing an `npmRegistries` entry into `.yarnrc.yml`: ```yaml npmRegistries: "//artifact-registry.example.com/acme/npm/my-repository": npmAuthToken: <exchanged token> ``` `npmRegistries` keys on the registry URL and takes `npmAuthToken` per entry, with no scope needed, so `--registry` supplies everything the writer needs — the same single input the `--npm` writer takes. Two details worth deciding on: - **Which file.** Yarn resolves `.yarnrc.yml` per project, and the home-directory file is the documented global fallback. The other writers all target a global path (`~/.npmrc`, `~/.m2/settings.xml`, `~/.gradle/gradle.properties`), so the home-directory `.yarnrc.yml` is the consistent choice. `YARN_RC_FILENAME` would need the same treatment the other writers give `npm_config_userconfig` and `GRADLE_USER_HOME`. - **Yarn Classic.** Yarn 1.x reads `~/.npmrc`, so `--npm` already covers it. If `--yarn` targets Berry only, the flag help should say so, the way `--sbt` already notes it assumes a stock sbt 1.x. ## Links - Reference page: https://docs.gitlab.com/cli/artifact-registry/login/ - The panel that needs it: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/255741 <!-- implementation plan added during 2026-09 backlog triage --> ## Implementation plan > **Note:** This plan was drafted during an AI-assisted triage of the backlog and has not been validated by a maintainer. Treat it as a starting point: file paths, line numbers, and the approach may need adjusting. 1. **Add the writer.** Create `internal/commands/artifactregistry/login/yarn.go` with `yarnrcPathFor(home string) string` and `loginYarn(registry *url.URL, token string) error`. `yarnrcPathFor` returns `$YARN_RC_FILENAME` when it is set, else `filepath.Join(home, ".yarnrc.yml")`, mirroring `npmrcPathFor` in `internal/commands/artifactregistry/login/npm.go:19`. Resolve the home directory with the shared `homeDir()` in `internal/commands/artifactregistry/login/linefile.go:14`. 2. **Write YAML, not lines.** `.yarnrc.yml` is YAML, so `upsertLines` does not apply. Decode the existing file into a `yaml.Node` with `go.yaml.in/yaml/v3` (already a direct dependency, `go.mod:52`), upsert `npmRegistries.<key>.npmAuthToken`, and re-encode, so unrelated keys and any `npmRegistries` entry for another registry survive. Treat a missing file as empty, create the directory with `os.MkdirAll(dir, 0o700)`, and write with `fsx.WriteOwnerOnly` for mode 0o600, matching `internal/commands/artifactregistry/login/linefile.go:58-64`. Build the key from the registry URL with the scheme stripped and any trailing slash removed, so `https://ar.example.com/acme/npm/repo/` becomes `//ar.example.com/acme/npm/repo`. Lower-case the host and keep `EscapedPath()` as typed, for the reasons spelled out in `npm.go:53-75`. Confirm the key form against Yarn Berry's `npmRegistries` lookup in the MR description, and add a test for a registry URL with no path and one with a non-default port. 3. **Wire the flag.** In `internal/commands/artifactregistry/login/login.go`: add a `yarn bool` field to `options` (near line 92); add `cmd.Flags().BoolVar(&opts.yarn, "yarn", ...)` after the `--sbt` flag (line 217); add `"yarn"` to both `MarkFlagsMutuallyExclusive` and `MarkFlagsOneRequired` (lines 218-219); add `o.yarn` to the all-false guard in `validate` (line 262) and to the `if o.gradle || o.npm || o.sbt` block (line 341) so `o.registryURL` is populated; add a `case o.yarn:` branch to `run`'s writer switch (line 422) that calls `loginYarn(o.registryURL, result.Token)` and logs with `o.io.Color().GreenCheck()` like the others. 4. **Say it is Berry only.** Flag help: `Configure Yarn Berry (2 and later) to authenticate against the registry. Writes to $YARN_RC_FILENAME, or ~/.yarnrc.yml when it is unset. Yarn Classic (1.x) reads ~/.npmrc, so use --npm for it.` Add a matching `--yarn` bullet to the `Long` heredoc (near line 137), an example line (near line 188), and `YARN_RC_FILENAME` to the `help:environment` annotation (line 200), the way `npm_config_userconfig` is listed there. 5. **Tests.** Add `internal/commands/artifactregistry/login/yarn_test.go` modeled on `npm_test.go`: file created when absent, mode 0o600, a second login refreshing the token in place rather than appending a second entry, an existing `.yarnrc.yml` with unrelated keys and another `npmRegistries` entry left intact, and `YARN_RC_FILENAME` honored over `~/.yarnrc.yml`. Extend `internal/commands/artifactregistry/login/login_test.go`: add the `--yarn` case to `TestLogin_DispatchesToTheSelectedWriter` (line 419) and add `TestLogin_Yarn_RegistryMustHaveSchemeAndHost` alongside the npm, gradle and sbt equivalents (line 261). 6. **Regenerate docs and check.** Run `make gen-docs` and commit the regenerated `docs/source/artifact-registry/login.md` in the same commit. Never edit that file by hand. Then run `make test` and `make lint`.